7083d1a5a570ab3f76abd253d586c9fecfa045c856700fa076c878455aa4e546

Analysis

max time kernel
150s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
Size 1.3MB
Sample260809-wtzvyawwev
SHA256 7083d1a5a570ab3f76abd253d586c9fecfa045c856700fa076c878455aa4e546
MD5 c42a809331f45caaf52d813c51852845
SHA1 10f983d9336af350c5a98824c31684a65da255e6
SHA512 d9fb2a6d99ca97cc1c36f8f2a41bf9e4a1a62b90465d613ee3a6af1406100e887d0caaa871fcbf28d9cc29ae621f06bce58a3bdec4a6db37f445f2ae4ecb81e0
SSDEEP 12288:3e8sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:u8snQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1355522253852D873E91705B04882C382677F0DB37BF2925BBB742E79DD792C40AAA35D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3204	elevation_service.exe
1044	elevation_service.exe
2436	maintenanceservice.exe
236	OSE.EXE
1620	PerceptionSimulationService.exe
1772	perfhost.exe
2868	ReFsDedupSvc.exe
3860	SensorDataService.exe
1840	ssh-agent.exe
5040	AgentService.exe
1012	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8107357238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000718a46d92a28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000540a2dd82a28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000faecd192b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dafa84d72a28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebee08d82a28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005025de192b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003efdb4192b28dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe
3204	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2868	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5040	AgentService.exe
Token: 33	1012	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1012	SearchIndexer.exe
Token: SeDebugPrivilege	2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	2608	2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	3204	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4488	1012	SearchIndexer.exe	99
PID 1012 wrote to memory of 3612	1012	SearchIndexer.exe	100
PID 1012 wrote to memory of 3704	1012	SearchIndexer.exe	101
PID 1012 wrote to memory of 5868	1012	SearchIndexer.exe	102
PID 1012 wrote to memory of 1264	1012	SearchIndexer.exe	104
PID 1012 wrote to memory of 4784	1012	SearchIndexer.exe	105
PID 1012 wrote to memory of 4772	1012	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c42a809331f45caaf52d813c51852845_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1044

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2436

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:236

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3860

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1840

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8d7fefe6d88d0ce0499b146904356cf1eb62397f157c72a003996b3b92cdc6d4
MD5 5edae922d68efc91dcc28745e2c5fbbd
SHA1 648c8cf6a02ea1662bb0aaebbdd7ace87b27d98d
SHA512 e1cbeaa3066183acf6b99da97c6c166b0052e4410e8a8a4e5d50f3e17cdddb4a03254f593781582556230f729ae82d367d9c5ad7f50be44a1acdc0c460271030
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmQ/lFTjN4:n3q6HjB+Lm
TLSH
T15BD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3e65f5356c16020b907c32d5612079298417ab0abb53905efc808ef40b66af6a
MD5 b8e148771eb48ea2d372be7f031f0142
SHA1 843fc088b5c9bb7b1790172d4226f79947eca936
SHA512 5a28b6f02ec1713750ea67525f589bfef876dfa4ae255afd2c6b20cbb412dc26c32f7ba4eca219e8d70fc3fb9e4abe617ce148d016157eb9f7930a09c55509f8
SSDEEP 12288:C1XLsswWkxy2lRq2czA9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:IXYfDtczAdnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T13F65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 23ef94b744f5cff0f9a1da9b7bec124bf9e939744d1b619fc4c1af4da43c0f35
MD5 782a02b10da866cd373487173bdc66c5
SHA1 fdb580fb02ec9512fe3d47543fc50f75efe5e57b
SHA512 4b73331bac950d491523e57b60a60896851353ce52cb8e3ec3d1b8fbaee738514e460650f11c25f39b0c69fecf0c05cf05191cd1a6f4f18ef29f0377013cbdef
SSDEEP 24576:H0Le5ji0hmxLrM+nQ/tbw/2Mkjy6Fr7g0oe:HPji0AlnQ/lFTjN4
TLSH
T1A0859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6e1ea9a4ee7f84413da8d86277420808b8b9703df15ad5e472bf70e781133491
MD5 8fa0f8cf5c4d4307195b683a8d37c8a4
SHA1 1bdb8e4f4b21cb0b60f885db348a053c06886da0
SHA512 c2c72f07cf0079eba9b75abe80b0504d0a42f85c687b3a345f1c637e5af5761685094a8751c524e397499854298d9e770504f41e8ccda3ed8e4340924087906e
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWE6q8wyuUnQ/tbw/2Mkjy6Fr7g0oy:5/ezSC6vUzPvxHjyLQ/lFTjN4
TLSH
T1C1755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 818ecc220c0640ffa5536b4328ede857b5bf4805e1d39f6a5b8f1e10b91313c6
MD5 07d4b8a5ab26d7bf11321274fefc4e46
SHA1 fc080a93ac81f0cbbad95549ab01a301dc148a43
SHA512 bbeb32168160f32095aee2266bd55d8c61a6ac1c33b1b160a257c57379147f9596226491b95639a33296d51a6f87b51d6a989c9c9a47d6ff8970b7801cf75da1
SSDEEP 24576:AVbqPb88hv/l+65nQ/tbw/2Mkjy6Fr7g0on:AVO88hXl+iQ/lFTjN4
TLSH
T1D7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0f171a6fcdc1b05bdc3c1bb11c52eadc6e4c59597985fce2f85860e3daa6d9c3
MD5 74c01acda00963fa4fcaaba5995ad588
SHA1 d77d8323e581df381893ffc6d35fb484e7b26f27
SHA512 3aa8d26223d9041df0e479ca352ce8b277e9d9f75c13835c7165eabcc3adcae6b7888c1c3817a66d0d7c4b0c7307625296df1dd9ef12bff77085330c1b09c5de
SSDEEP 12288:ezKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:ezKnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1A25523696A24F897FF2B06B15CC284826B7B0EC1BFD4A74E7B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 bc89b0582e4702cb2cab7b0bcfa9fcf5c30edeb4f4fa76783d62f19e0cf9cdf7
MD5 0783e80c3529c6248bb181be25ca2f2c
SHA1 9a6e41557a3483e41b501c89064ca5d224b770d4
SHA512 b329a89aa5720acf46bfdacda3e3ba731b17276b4e47be4d68847d7abd15e3303275bd134fb7b08420d43483a6f1bff2116d9201b2ee9f055ccdd7060c3fe24d
SSDEEP 12288:meBNUbTVO86UBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWcz:mJIURnQ/tbw/2Mkjy6Fr7g0ocz
TLSH
T1AF75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eac98328b7c66367160e30751a932a2104f14a1c20f05335021efe73c3b5d1f6
MD5 0d82552592fabc5069b0c5c9d814ab46
SHA1 1e0837ea21e2cd3d171c4560a8f7d48e127bdb63
SHA512 58ef6ae9ba89060086e590d7d06f7512d3a91e8189e8d676b01f2ae452a127c79039fd9662b6356b7fac7edb5bb3997af2455fe77579b55c27da2ae091c7d913
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:GQvGAdlCEL8c/yRNw5C3Lm
TLSH
T1C7267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5d042816f75f1d4989dbc99f46436d435b6ff4d1c73fddc4bf8961e8aea1ba58
MD5 7f457d6acc37656d94f3f444691ffc28
SHA1 3c7474029faa0bfa8fd63ea3acc9fd118818ee55
SHA512 cc7b1304fcc20738e13da2d7aad5e5cf19e34869854100f586c66bb7f2d03abe32ce12903241748440d51bcfa22df94a22841cca0b0f860b7d73e5781eafcb0c
SSDEEP 12288:VAwSfxL/2Dc39DLLmt0LDQewsAj3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:2QewsAjXnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1A475E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eeb6c27bb9617b0d02d558548f0603350ba9339b7b16992242aece5d40c20829
MD5 be43f690c489fccc2564de4d0b3aa03a
SHA1 f95ff3eb2370f284279a03be5a7e08f3303b3f2d
SHA512 07036e70f704ee9eab62da7e36805718d862cc250d8b2a1af049603e3e1be13f6be74a7b1a893038a2546fc79f958c96f8f56d6452782874a2bb764f655fae49
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH0L:XUEtQevvqc2W1cpV2EI32
TLSH
T1BB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 504d4b7fa95a1857c891fdb34a7b611e7388cd856f8f60b0729f549923a914cd
MD5 6404e9e5bda34598c782aade2ef46480
SHA1 0d0e384523bef0f7e2d320bb832cd7cc7c87c4fd
SHA512 9af131de6e9a03bd5690964e48320b89c155d1b5203b0da6004f6c4954bce9267b6881b33cd764cbe968dd024262ace2de14de875c2bf12f59216843b6727af3
SSDEEP 49152:RCbRquA/m2yL5zQfFiV+XenmE3/z3Q/lFTjN4:eoqtVjnm7Lm
TLSH
T1CED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b1df1531a8b880555a71a66f4db482459a42164076a3cbb81c739301ada4a63f
MD5 a6ef678b1847a296bf102e4f7d91d796
SHA1 8dc054327cd799527a5bcfa220e264ef62e817f5
SHA512 b0f08454102a68fbd2ffe6e6448489f9b9059e5078f528193545b50caabf243dad44aa256307414914bd269173207cb2756371d512cdd67d2b1eba8d0722c534
SSDEEP 24576:2AhGLJIFoiwtA5l7S534nQ/tbw/2Mkjy6Fr7g0o1:2AMyFoiq5IQ/lFTjN4
TLSH
T10135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2b491fc8cd452c0b1a94cd8092845a9fa2a1e686010e8df411434835cb49fbfa
MD5 350f8497daa3ee76ad01e327dafa33af
SHA1 1b70723d7fbc525bebe992910e0f758d259826a4
SHA512 7c5e63979a10bb28d1998c76d9b7f9e153cf9b4d28ba939f55cbd043da29f91fd5d08445d953255ae48c40009f5c8f4dde248f32ae8c6cb8e159877264faf041
SSDEEP 12288:Nmw5HEjsChN2BFgl0WDm+CUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMJ:owuHOWrnQ/tbw/2Mkjy6Fr7g0os
TLSH
T10A65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7edcda4d9229918d0f44aa52bd73d585ecb433722cc2d187b00552b2dde03f76
MD5 2b24792432a07678f79b581a1fb974bc
SHA1 24a7682d19e2ebc431ff06ddc47fa6e6f271303e
SHA512 ec49b8ee99269ada0d456f7557855b054195ef0219e2f2e39f9a529d0931e3994e32e066b46dcfd950638dbe5c176eb52eb5d4d8c2477672f0d5cd7c7ce9a6a5
SSDEEP 12288:GXZ1IynGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:WZuWnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1C855126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D51E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 032e136fbe17be5a97d1eec8312ad4b70fd67a43143257b76b2785677352d5c7
MD5 a70a1c7ef14405d04e6c12a03985d539
SHA1 a59e3eca4bb10401ff75cfd42e7c2558531debfe
SHA512 57ede854d5edde6fa79df0cff0791b6bae79d93496021914f1582d3ef4226af0865483e6e9b7a9459ab5c99af95805242d7fbbe24225caa5ba9147562e36b3d0
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:oQRQyi36YOcPQLvw2gAf+PN3aLm
TLSH
T189667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2c541f6ecd0476b3469038b81f0860b998b3a05ee9546eb2f9da4c9b309b884a
MD5 2bbdf4358784ce5458b0681f87584a2c
SHA1 1e4f9861a141fca7e73df596567b7c5ff4a63639
SHA512 c9413fa801f761079a4f9788f1148729d7cc2b278ad447b6bb8ceb74055eac1ca3b5a6f8f5d4d5abc2ea03a346118e143d2cb13cf4f6220048799a0f84670fc9
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:TQRQyi36YOcPQLvw2gAf+PN3aLm
TLSH
T1F5666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aa9ee3f56e214056bda5776f9e2b3a411592bd6c9d1282c0db3909efccc5a6a8
MD5 b3f635f3eb1737410e2b152e3353c6fe
SHA1 074d8261f262b2d993367b43ada67e30e79367ca
SHA512 8357f9a30541a8f900d5842a647ff75598ce4639530a21ff0c51bef6e37cb2c73e5d52bd0a910b5cd05a4bd73e99ee627e8dc3f897849b60177e3ab151ddbdd6
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0mnQ/tbw/2Mkjy6v:o68Qg55nhheWu7PNU3/nQ/lFTjN4
TLSH
T1BEB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c68d08fbc217cfce980aa9c4ea089f8cd1e07ce489ba8f59fbc68dec2c5bcc75
MD5 550e5c0cded627674e3f82e03504b681
SHA1 f5ff4d794acccdfad714143f9b8e5ee96a655057
SHA512 53e27d84251a059444d658b52a7d159ce68b48a36a0637fd77cb90caf292480c57af02860c39b7e8f14d856ad3aeca5a9924267f25d4c27248d4a09d5959de29
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:gy5112gYy5azzVvL69nLKnhZFLm
TLSH
T1B4167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fa3fdd4cd9bf10f0b9e817475950fbefed3129e377a63a69c341bd6eaba8cf49
MD5 6014a9defc8cd3ed2f00d47e78dbd79e
SHA1 9292d35c328a1cf70267fead88a195669fa16337
SHA512 f03437411865bbd1e743ad75f8a81fe4b42e25e4776560dbd34ea6044239f9830f01b14db3dda4d22498d801d2e43b375d08c35e3ff7b09ab96a2c10f39ac53f
SSDEEP 49152:fB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gltQ/lFTjN4:hu6JmVxd2diLm
TLSH
T198D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3d908549515ff9852fa5e4dcaf41b92d42f242e7b18f89bc505c28238e529379
MD5 2cdbc0816ff200c3eb337c283c330706
SHA1 7bb8c1c5fb5c09ea199b52c3353150011d165401
SHA512 b8b8458f5a21556f891197769353656a5d0481251f312e5051a887585e45f0913b5d826180f26f9bd029d45c0378314484ed88ce9a8a21406df0e1153ddc3e37
SSDEEP 49152:/1hpsNoJpF1A6UU44CwH7R4xxQ/lFTjN4:/mifPbR7Lm
TLSH
T1A4B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d7a8c31505278890779798d13dc061b1760e050b59fcaa6082665d0e90da7879
MD5 0ba7f067a4933fd36c3f80e03f97cc2d
SHA1 ffcb0697f9cbb42c5882c4627c8ccc9b3ca5cb13
SHA512 0c1c51f7d574185229dfc8a31ca7fe17ddf39982428e0b9f179f342ee13cda96f530a6e368d472a31578804c3e5f74058907cfa94d18c14a1fe21af1725d7cc4
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHqWQ/lFTjN4:V5dKTi61hLm
TLSH
T1FDC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ac8d4a7a95a38a2fba652fd05a13e13181e77d98672fa9e03856535b12d47b72
MD5 4ed497750e995911033007e3b1947542
SHA1 04a893682094d45aed72f511e7d7a83ca51f0cb7
SHA512 a1b2b615a6193b0665e0cf50843f19a439e839751aec9d60db91ffadb0bc961472bfd29ccb46bdb46368c67047e04f173c20680325891522b1d0d69ce48c1003
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wdQ/lFTjN4:CX2iyphvLm
TLSH
T11695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5d542ccfdb70773d11b8cc15cd0ba77a71d51d752c25e62e0bc6145af1236fa2
MD5 cc8e286a6a81802b37da474bc1dfb74f
SHA1 4474dd9e20fd8ab83e5eead10e6a19856ed5df39
SHA512 7e9dd3a54b5567a02310c2b2516922b1aec731a6f080ae4a6e37bdfd1a052633d574b9e320df3df4e5c82465ae87b17e7f3ddb11aa293ce6662abadee1164035
SSDEEP 12288:BiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:BinQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1425523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 85b6fc0a20f9bcce5e2f3d6c227d69038dfc468af95e6b0301546c19861259cf
MD5 7cc6568088a751fc2a618cd2765366fe
SHA1 483ea1f4166c5673f2516cf6338235efdecfa723
SHA512 72223ebf77150ebbcff3cf4434b21c4246f994b69fd85cef2b63d64a77c18bbcf6509f415ef48fa511fb3c76fd29bff855cadf8ff998b6cdfa1c5cf59b96434d
SSDEEP 12288:yjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:yTnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1555523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cb3bde4fadf8d8e70e1a82857a790bf1628c081da8e9ad1e8fa735c24782e1cb
MD5 438e54a4f78deaa4ce18fec364bb8027
SHA1 491e5de719b779eccafd5d8f8600ba08938c3d8e
SHA512 746384fe586c0735ca2b3da53e11b41294c0d52ea7910bfcf7fa86eaa15dd614170d1675205bd983eeb66e636fd8398dba84d46fbf0ef4b3e582d4760157b3e1
SSDEEP 12288:05GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:0JnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1DF5523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6aee4dc50ff63e174311391aca12a00a5087aabdc0ea089a7beb281fc5290965
MD5 1fdd5526e5befa2c9e303563fde28fbc
SHA1 0809ddb94ccadd75683e1d3eb397aa300d82280b
SHA512 ec71856d6154f0084674bcafb83a4c8a9a2a17639bdd1b721eb7e7c6aed60584ed9d7cffde3a52ecf6e249d9f45184d1988d028702cd1c553b7c751daf175574
SSDEEP 12288:NVYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:AnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1C35523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c2a96322c751a2f655d8f07526296b94b77b4fb9ca66390fac03a08dae9c6fa6
MD5 a4a70020d09e8773f3a108718575fd10
SHA1 306320b177649d51420416fb50347a7096e80483
SHA512 a54854cb96cbd93ca5266a29801edbca3e8ea85f1c31947df7897b54d8cef3bab20ec4a7fed4ebe31defb59ebda6d82546db96c03c111f85ea1fa8813667178f
SSDEEP 12288:igGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:iAnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1535523697925F98BFB1B06F14C8381829B7B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fdb00f57e54a394906e3e39666f490d37714ee73dbd48e12175ecd28513738e9
MD5 0e74714f6572ed95650b228977aca736
SHA1 9ee3eac839509412ef801fea07a83ddc815895b9
SHA512 d21b5fcf2fc4f00839b6a2bcdf0bdcfe54d15192d5fd6bf66b88db778c811c65b5b7388bb3e9e7e590862cda9cc6cb3b064c7bc541cd9f5ddc1058c424f9479f
SSDEEP 12288:wPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:wvnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1715523697965F98BFB2B06F14C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9793c5837d76ede37fa42e60db617f40ed714fe8020f0df10f2fc8025bf6fa0b
MD5 ce9a7fc1e5aaa3629f78ba57e39d7542
SHA1 7258cf912da2f22420a3e093da61980a8156d030
SHA512 9e12b1e76a3106a38a62332fdef4500553931353ec26ae29a45f18994079ec8880ac0db75a5d258f41634e252119c6574959cc4c23f513c17f83d0144972bc12
SSDEEP 12288:ULGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:U7nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1265523797965F98BFB2B06F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 224fe6d1de2cd5118395e9d106616b115ae4af29dbe40f6c9f820d26f336e700
MD5 e7ce384440b5b72ce23535b2845a4ae0
SHA1 c6144c77cd832b368eb5078b32e055a5c0ff28fe
SHA512 11a7a088d4104dc9da5fe17f574aab8406facfbff804ae11539310cb07abbcac9ae458c40cee19e6836c9b3a6c34afedcafdf58f46957454124881ae88e16f75
SSDEEP 12288:kiZwbDzzFEoS2cPvyDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:HZM3zFVSOznQ/tbw/2Mkjy6Fr7g0o/
TLSH
T19A7501A9B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 da290e4a251f57c40bfa4d675ef2af6398eda49c5800477898bfa30e9b178139
MD5 7586e3bcaf40abfd11dde54ea09a8704
SHA1 e9de584a5828fe1f3bafdc6eb8f63d1fa3d2e92f
SHA512 d1efc209f48e028c6c0c76b60e5fa4de9d6ff5041e00bc5fe73575374c515b8e6ffac3d11f6a23be1be8127647bf418c1747a9a2396ccdff64a39c2012f3b03c
SSDEEP 12288:TmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:TGnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T13F5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 92168c496d3a11bb3ef7f05433955a01c10ac066f8b0830f52401a592af2048a
MD5 72e2da09defc5cf4caa32f058ab7448e
SHA1 f57705a8a14bc4c9d5eb116da7980c9a1a0bb88b
SHA512 728fad966523ace04d2119c49f145f0a8aa01c8fb8be25abcfbfbd68e4756f90f52296d17ae68cd7c400fa3dff6f3fc76e877125e3889db97f06367dc5340586
SSDEEP 12288:I6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:I6nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T16D5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7622bde66cbe598a2bfda88b2c5ec8e9f2c210a5462a88d670406bfd9b01a4b3
MD5 64da4d63a2cad78f37a6fe10c5f400b3
SHA1 04e5eac3db3ee4833305a08e893bf987cb000831
SHA512 7f78d2c7302e7519c7a8eb1fbedc46dbf91001ceae2ef1a0e05ab4a5ff4d4de366a230c6a004f179f218a056914047ea73c83da3382f97645339212650c324ec
SSDEEP 12288:vyPz5L8nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:CzyHnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T19865021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e409aaa405ea9070703c13b95f2227fb181d1e19157eae6c8c4cd24a9107be03
MD5 e9aba5e1893e7562bd77350510c1096a
SHA1 56a226c92ae841fa18f84db82a03d5902df43abf
SHA512 dd25e2f99a3e3b2c34268ef9f925636c86e4044d3657453da34eb3708374c8d8b195a5f530b739c1e4b24bae365fe8c96be2c2f2471d4b774632561e6b4e5d12
SSDEEP 12288:pmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:pGnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1C75523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2a3e624e475bb2b0e09af24f066b49827dbf1d0446959dac983a9a8a04c97c91
MD5 4ab8c7975909fc379d6d5525bd193ca9
SHA1 2d867b0373c44c87fdb326f96f09e5fa5cf95f8e
SHA512 c0bd5b881f2f9bc9c5cdb63a597e7887245a59893809031fedc69ee13dbebb5d0a81dd421482d33801e8a8c565bbaf4471a0ab2a5c54b34e1bf4d7078466a4e1
SSDEEP 12288:smGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:sGnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1095523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d124b60ade66fb2fe6c893be20b0b5f0288f85011b965dc71f3820c462ba44f6
MD5 5f3e3a09dad2fa332e11604f8680bf32
SHA1 7249d2eaddd337fc8241e69703cf9da9b6e8170c
SHA512 f9bbd77a171d2a2983f3ef1347507c23dea9f0c1574cf0683cf635815cf8bedbcfa50eff9e5499b1f926d32d4745b2d5efb571e93a13248cbaa5411858fde9c9
SSDEEP 12288:3yPz5L8nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:6zyHnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T14065021B73A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 dd64bac7a1991c6647aff0806e8b683b25e3bc114888fea1d79132fcbe0bff18
MD5 e0bd15cb766ab6525afe9f962dbba581
SHA1 3602d7c01629a05e80a52aea367171720a3646ef
SHA512 8b078ad2958fd7a13e858f85c937c9c6bee1087327e9de124c7fa3448e845441befc8c761ce96757d957e73e4a7e8163f778e72993ed0ec3c7051b8265f9e178
SSDEEP 24576:WT0aLl3z0zDZnQ/tbw/2Mkjy6Fr7g0oV:WTDLljUQ/lFTjN4
TLSH
T1437501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9e3165c6f45edf80662889016fe97217f811231fb2044aa7575b588a085eee7c
MD5 9a4b5060ede3d2a391d313c1fe770cb3
SHA1 c7904c9e6b95f40d9921cd6a43ddd1a11b088d66
SHA512 f236415f8d38bb64a15557444fa078fc0ec268c3ddb87fd7872c4171d5eaeaf9f1eccea216b5370ef050a498b6d3c9d35ae4794bd7a210bfda2679728d3728c7
SSDEEP 24576:I31d9CHKy7GZVnQ/tbw/2Mkjy6Fr7g0o2:S1d9CHKyafQ/lFTjN4
TLSH
T15685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d38f1d6b71e33a826115f97146d4835b356055d6797d2e104feea077196525c5
MD5 9abd361db8b5011bc43d239453144aee
SHA1 fe0f8c3e17fdfd69eb814fc9078ac7df5157b9da
SHA512 a8b107c80d62774607f461fc65e0732a1683e727531f0985ce93dc185d49cfba8180f8a59dd001a28bd6d01fd3e9acaa0cfbcccf5e1f16c299ddac13cb327ad1
SSDEEP 12288:JZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:JpnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1395523697925F98BFB1B06F14C8381829B7B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 932bcca08d76ba36eb817160d3029f2944138117860239f80f9c7c4a9d574232
MD5 5cc3f01aa68190d2e133a732b1d95a85
SHA1 875a0ec9dabc29d8dabe1e25e1105f6784711a43
SHA512 28be1a5dfc5d1c176ff8c07b3328583249f95a26118c5145ccf4488c31e160a3fdf348dc500e1e62437ee9d7810cdd4757585aad08b5f34ce5911a59cd9bf09a
SSDEEP 12288:pHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:pnnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T17A5523787964F99BFA2B06F14C8381429B3B0EC6BFD1938F7B481129967D39406DA384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ea9de5992f93a45aadb518806da7086f2d019e3479e29fffe18ec7b5299588d0
MD5 a728c0ae9326e6203facf5eb9818eba2
SHA1 33e52322816e3ede001b094e19284f0062b96698
SHA512 02446c05348e71eb1e6dd53fde460e13ec79ec40301cdca0462e8c7305a1d3ef46b7aae53bc1f7cab858a6af56647246bdb4345387794d130c9a7aaf7a218836
SSDEEP 12288:V8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:V8nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T12E5523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 64d5de49373615027d5bcf5fc0941e38c6afce6749c08b6e4701c205f7ac576d
MD5 5e00716ab4c63a0faa6dac2e12ba5f20
SHA1 368c741e252336f456817aea766d4c3d71bfa2fd
SHA512 65ddd2ec52f95d9f32705010ef3f2281df435ecbc90cbd494e7e9bb042857858c2ba0e10e9c50142eed68e9044c690d314a3d893a4339b9c5209f5c2659eeee4
SSDEEP 12288:0mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:0GnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T11F5523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c574b8279bcfc07f888d91a1f8f19d05ba590f7df3a90a7605d86794f52a946a
MD5 208682e40f69d507766ce629f6faf106
SHA1 f373b3a8bc7173c7d972567aa82107e886f1ac98
SHA512 0b64a43dea6eb33c080ab6df97db68ece45378cde4363ccdf967c43dc15d0e5cebf63d81610b0d9689bff333fa07b88e889a33435f4abc5d9e759443d87a33c4
SSDEEP 12288:BZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:BpnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1145523697925F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3ded03b15bea399c521988afe5f04266f85c413ab30dc2677511d5f5a5836d94
MD5 f12764b7e2fae31a54e43aa6f1b51697
SHA1 fddba75ce399c9b89040a6edfc8255ec4558689b
SHA512 f18f9f9b6bd0f6b5dff84c938b0d49a4411e670eea3fbb5dd7e430735e9ab7ec81b377847b59f3b611e75d3dbb533df485433b2b2fda886e4ae5494dd422a344
SSDEEP 12288:3OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:3OnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1045523797964F98BFB1706F14C8281429B7F0EC6BFD2938F7B481119967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 19ca1726f537281fe4e43217266a6778106ff798c0f9538096e78156d05ff375
MD5 f75c2f54fb0404a349ef658b3404f20d
SHA1 cc586d33078c31557b9be23a042ae7c2dc33ae3e
SHA512 15fb1938e69576b18ad2ee0ccfe8fff7af94a65036b8949516ea97a048eafa5c4421b9de7a0a6032b7fd25cc7d8364b6c5013dddf18ea6c25171f3da98c1df59
SSDEEP 12288:lgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:lAnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1BB5523697925F98BFA1706F14C8381829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 51620ccfda22b9ff75d6a9db0e0273eb510a4972dd60057a3a762684d7285027
MD5 bb34c70cd795bd71aba75d2407b8e2b7
SHA1 411783cb8adbfc46b15d399821c25f13164b176d
SHA512 2ca03a2e444e217380b585eb8050cd7a55167c84035065851dc4772fc1578e43b10f811df9d373999acf8c938bc8616fefabe8422cacd2f859ebec56e18b6ed4
SSDEEP 24576:hfwv/k9RX6wkyAIqnQ/tbw/2Mkjy6Fr7g0ox:QMnYIqQ/lFTjN4
TLSH
T1E485DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a1d0ed3d9eee1794f0f94572a0942da51076e64da4b2dda8321d2b5816e7c651
MD5 1552ae652da8265736e7bb3aa778bcdf
SHA1 6f80e6060b413a52b8309f5c2b48ef30ab2a3251
SHA512 841ba51e0995136282e8321a00970b5260ef6bb453d94f145995e6d91d7f32801a722503369b2610b37755628c1f0b72af2c0aef3c1ef83642cee971df3d86ed
SSDEEP 49152:FYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09Q/lFTjN4:FySzP6Lm
TLSH
T148066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1639b356311d12940c5de02ae48b19e017166b380909c9622dc7394c7d4489ed
MD5 cd99c4e984b53ee8a1354c28b825b1ef
SHA1 a9e67903cdc3aa69a95c7c1fea63e8cfd808d352
SHA512 2972fd5d07419f28acb84658f00eb05b783bc1ed12521012326b67d2ce9535d90e5ecfc0c82618978258c2c3f6f57a0ab52d74680fb745646f16a3042eb1deaa
SSDEEP 24576:047Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYjnQ/tbw/2Mkjy6Fr7g0oI:047JUQj1irIhCnDHUPfF/tQ/lFTjN4
TLSH
T12465AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9031c7485711b41b0b241161f72e318e4017297583473659b7234d0a8f3fb7b2
MD5 c4d55ae4a251a47a4821fa362503e53a
SHA1 60d800bbc0fe4c3399f95ad86e4e5c49d641c030
SHA512 112c5abf97a6b5b7e83cd2327338fff0745322d7d8c4374f44c1931907d6384d4df08067fc727eaf179d135c8ca51843dd83e3d3510a15f7e6522954c9eedf14
SSDEEP 12288:Assf2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:OWnQ/tbw/2Mkjy6Fr7g0of
TLSH
T15D65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 95fa2892af11df785720d977bf1d726421c919891f071278859539c47b64dba2
MD5 84200a6c9b3d324fd7096fadf50bf6b3
SHA1 eba5023c2c1938364ec74e1ea8c8a636af77b853
SHA512 b90259df5c7ab30e8d55cb65f62db1fe4c67f07909658465f88418e5d0f14bc5f8328fa695ef234b722cbecca97b3812d253e96874d139178a2b5290996fc09f
SSDEEP 12288:pjF+oy51u78TQwqN+4vQCLLTONv8uL5SDkHXgMXrKXcY:pEoyhD6XONvl5SDIX7bv
TLSH
T142453950762BD75FC6A940325E32D6CCABB07D01EE455B0372C8873FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 667ab17c4628d802a7c2dbe06a0ab5014145f0ea04096ea795d4f99a61f54f58
MD5 a3af459638326973265f3060d7d06f6f
SHA1 34d88ee510131bccbc2236a132fe58202c8fca10
SHA512 88158a769b48b5275c9b2d7eeaeec47ab3f45b1387da8852887ecf19be75bb1e3ded6e495500991a6215f8dbe48358ee4370daee101097b575c8227f40c9c651
SSDEEP 12288:dXf8YWyJbxNPfD2hd0UMKaFcxaglMRbJV/d4:KYWAel4J56
TLSH
T10765E841A537E38FD1F76032172A5A4DBB74EC02B7096F2673C8053AD86A725B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2ce314f29b7b4c806b849ccd36b1822d545b3695a91085c751756f0c2f3543c2
MD5 fb881a3c975afe0cf353e680e56e3e88
SHA1 8b9a10d092781b90cd2393c449fa987e896b16f9
SHA512 d7e7b6605803357d23a282acc0539cb50b447d8676da6b3d853f59aa8e1098fa7516ac6dfca59a06669cd67a3984a3fea9f6ff9a759a2ad459dd9287aa744f43
SSDEEP 12288:a67eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:9enQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1F05523796668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 785bffcc34a55a1c276d763853484b7801127161e7898409e9d831eda8b33961
MD5 f4903b8f8d51d8b7ce4f7321f52c312d
SHA1 f48b8e8edd7df397be6d6013abc8a507f8044a3b
SHA512 33c07d9c7668b77e901992c37908a498c41a860af386f00c3b2ebbfd1a538d783971f78696ceff7a56bebc9d2c01dc8544ab22777a6a385a3c5a13a4ce865bac
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYUnQ/tbw/2Mkjy6Fr7g0oP:rgb4mBIBhGFjQ/lFTjN4
TLSH
T1CA65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8a2ab2b79c8450d5e818b7b931f82f6da41a9d50600cd5063680d772c0615e47
MD5 8db257ee2811cf41a85f58a79a5c06f3
SHA1 d05452b3effae7cca88ab25a18e471768767ab9e
SHA512 8d398826f8977d6dfcad9f6d0a78aaf1515e7bb94925a5dcead56514aebfc6483ae450b35df6741fedced08c5b72bcbfe83054365d609431e400e7d325353ffa
SSDEEP 24576:kG88u8FpJqH1Qzria7/mznQ/tbw/2Mkjy6Fr7g0oV:X7ZFPqVva7/cQ/lFTjN4
TLSH
T1C185F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3acf078cf0fb7e8182d85a1e7b201ebce428c0baedfc681092fa8f3dadba017c
MD5 f4c3a5a7a6c384e674bf67534a948ac4
SHA1 45dba878d3674f830149945050a798f6972b5576
SHA512 34ed5de61e9f9ebec511d599db2dbc9ad46c7f51e4aae98d4e5400e73cf4e087cd2dce08bd84d22373719f3f8dcb59cb423c465f07a52e2844f6b259a996b864
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvQ/lFTjN4:tG05lO43bdLm
TLSH
T17FD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e96ba216f1d618934ff96c3093eef5d4b853fd69791c22547c2cb90298ecd55b
MD5 cc9286ad98f2c14538c0b862fa018ab6
SHA1 041b4b64a8ac0a6c8118b688f564a30f97bcc88d
SHA512 a944fa81f94a742175e3eef36eeea232f726696e7685efb5b7fe09f6719719a036e61acb7f96c3c33c3d16c7105ac54dba05018442844cee7dc670e68c77cc30
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn9nQ/tbw/2Mkjy6Fr7g0o5:8a5POZ3+Jt2pasx2+mnQ/lFTjN4
TLSH
T1B765AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d15032e20e11f4c974dc7957ff09845243a4d11ba969e2447d71b5107fe63f3f
MD5 12f4cc9a0742a9052d7703f35377de1e
SHA1 071fba203349d909396ffb476085122348c8e640
SHA512 dcf33c7a41d6f7b09b39c4ef4dee383f9f28080f330a3885107e8ab6389028ea96118fbe983d936823cf1e840e4f40c03e8fefb59e30dc7f5326f566f3d2b62f
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7FkLnQ/tbw/2Mkjy6Fr7g0o4:CNc/zEOVHF8Q/lFTjN4
TLSH
T1C4858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1387d0ba4d64680458c8f04f674f50e770b25efdd19d61ee38eff3044c929767
MD5 6c7bb6e260ee281cb030a1ab07099b04
SHA1 77832388922f2ef4df1baccf0ca7ee805165af32
SHA512 12bceb442a1d940786983da1c3494255814cad1789a518aae98b9af0ec738453c3defbf78323b0d68aa763a7bd54aad7e14043ce956cf88ac6778abc3ce0efea
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBmBnQ/tbw/2Mkjy6Fr7g0od:Q8MwBtOmBQ/lFTjN4
TLSH
T12555AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7e81163573039d3312de317a83aa0b466e3359c4dd46dfb748f86d6308dafa6c
MD5 532c11bb688d7c1b33979d9073e3d393
SHA1 e938c2fa2449fdf971d0d9c06ba7d9c1855f702f
SHA512 0d85ddbe359af02fb7c4565f60313057e3030df0a9a7b8b9094516bdb2db026884675e8c5ff0d8bdc28bb4db03c3ea00100914b41a9dc83b85f531ddd0f3e904
SSDEEP 12288:yHvUrBFrEjwaQ/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:yPUr+NQfnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1C965E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 48b1b760cae58a623581cf3435a5bedc2d15f4721ca0e3c5d5e00c0497344d38
MD5 a9781153ef0556ebc612a08b25137ad7
SHA1 c5f2f8e692cd699c25df1d5382ab4232e2033c37
SHA512 9f7cbe2619f5228e657f4762530fd1fb3620da01d6f15e65157704d6cca3d8e48f6bafccb7356af8335e172073a38c8dd5fadcd03ece1641cd6a632462efe107
SSDEEP 24576:VD3FHshBIYQgACnQ/tbw/2Mkjy6Fr7g0oK:VDVHeBIAACQ/lFTjN4
TLSH
T18375E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/236-259-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/236-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/236-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1012-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1012-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1012-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1012-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1044-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1044-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1044-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1044-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1620-291-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1620-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1620-72-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1620-66-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1772-305-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1772-78-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/1772-83-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/1772-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1840-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1840-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1840-312-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1840-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2436-49-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2436-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2436-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2436-45-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2436-44-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2608-76-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/2608-6-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/2608-0-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/2608-1-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/2868-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2868-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2868-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2868-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2868-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2868-327-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3204-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3204-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3204-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3204-19-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3204-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3860-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3860-313-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3860-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3860-101-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3860-107-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3860-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5040-127-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5040-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5040-133-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5040-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5040-135-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download